The first category of prior work in the area is called robust aggregation
[1]}, [2]}, [3]}, [4]}, [5]}, [6]}. These methods provide robustness guarantees up to a constant fraction of the nodes being adversarial. However, this fraction is usually very small and the guarantees are limited (e.g., only establishing convergence in the limit [5]}, [8]}) which compromises their effectiveness in practical systems. Also, they require significant asymptotic complexity [4]} and strict assumptions such as convexity of the loss that need to be adjusted for each individual training algorithm. Some popular robust aggregators are based on trimmed mean [4]}, [3]}, [8]} and return a subset of the values which are closest to the median on an element-wise basis. Auror in [13]} runs k-means clustering on the gradients and outputs the mean of the largest cluster. In signSGD [14]}, workers retain only the sign information and the PS uses majority voting aggregation. Krum in [5]} determines a single honest worker whose gradient minimizes the distance to its \(k\in \mathbb {N}\)  nearest neighbors. Krum may converge to an ineffectual model in non-convex high dimensional problems and Bulyan [8]} is proposed as an alternative. However, Bulyan is designed to defend only up to a small fraction of corrupted workers.
